1. Field of the Invention
The present invention relates to an apparatus and method for detecting an abnormal sign for detecting an abnormal sign of an apparatus to be monitored, and relates to a technology of detecting an abnormal sign of a system (solution) made up of a single computer or a plurality of computers, for example.
2. Related Art
Examples of a method for detecting an abnormal sign of a computer using data obtained by monitoring a computer, especially data whose information source has varying features (non-steady data) include a method of carrying out a threshold judgment on monitored data using expertise (conventional first method), a method of estimating a situation of current monitoring data using a learning result with past similar monitoring data (conventional second method) and a method of carrying out detection/prediction according to a situation while changing a model (conventional third method).
Examples of literature describing the first conventional method include JP-A 2001-312375 (Kokai) (Patent Document 1). Examples of literature describing the second conventional method include JP-A 2005-309733 (Kokai) (Patent Document 2), JP-A 2004-213618 (Kokai) (Patent Document 3) and JP-A 11-338848 (Kokai) (Patent Document 4). Examples of literature describing the third conventional method include JP-A 2005-141601 (Kokai) (Patent Document 5) and JP-A 2004-54370 (Kokai) (Patent Document 6).
A threshold judgment using expertise as described in Patent Document 1 is considered to have relatively high accuracy, yet often accompanied by difficulties in advance threshold settings and it is extremely difficult to judge highly complicated situations.
Monitoring item data which can be acquired from computers and solutions (a plurality of networked computers) not only greatly vary in values and tendencies depending on individual computers and solutions but also include items whose behavior changes by a restart, and therefore the methods of Patent Documents 2 to 4 which perform detection and prediction through learning using similar monitoring data cannot perform analyses with highly accuracy.
The methods of Patent Documents 5 and 6 learn from quite near past data and can thereby detect anomalies with high accuracy even when individual conditions are different and the methods also suppress calculation cost using successive learning whereby past data is forgotten little by little. Especially, Patent Document 6 is a technique effective for non-steady data, too. However, setting of a threshold for judging an abnormal condition requires human judgment from output results.
If it is possible to design such a model that a normal operation space of a computer becomes an end of a space and cover all spaces in which the computer operate normally, Mahalanobis' distance is known to substantially follow a chi-square distribution, and therefore it is possible to judge abnormal signs without setting any threshold by using the Mahalanobis-Taguchi methods described in “Strategy of Research and Development—essence of splendid Taguchi methods” (Genichi Taguchi, Japanese Standards Association (2005) (Non-Patent Document 1)), but since it is extremely difficult to give data that can cover all normal spaces, setting a threshold requires trial and error.